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Abstract: A physics-based risk model was developed to assess the risk associated with thermal 
protection system failures during the entry, descent and landing phase of a manned spacecraft mission. 
In the model, entry trajectories were computed using a three-degree-of-freedom trajectory tool, the 
aerothermodynamic heating environment was computed using an engineering-level computational tool 
and the thermal response of the TPS material was modeled using a one-dimensional thermal response 
tool. The model was capable of modeling the effect of micrometeoroid and orbital debris impact 
damage on the TPS thermal response. A Monte Carlo analysis was used to determine the effects of 
uncertainties in the vehicle state at Entry Interface, aerothermodynamic heating and material 
properties on the performance of the TPS design. The failure criterion was set as a temperature limit 
at the bondline between the TPS and the underlying structure. Both direct computation and response 
surface approaches were used to compute the risk. The model was applied to a generic manned space 
capsule design. The effect of material property uncertainty and MMOD damage on risk of failure 
were analyzed. A comparison of the direct computation and response surface approach was 
undertaken. 
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1. INTRODUCTION 

The Engineering Risk Assessment Team at NASA Ames is currently developing a High Fidelity 
Mission Risk (HFMR) model to assess the overall mission risk of manned space systems [1]. The 
HFMR model evaluates risk for the ascent, on-orbit and entry, descent and landing (EDL) phases of a 
space system mission. In a nominal mission, shown schematically in Figure 1, a launch vehicle is 
used to place a manned space vehicle into Earth orbit. The manned vehicle remains in orbit for some 
mission duration and then returns to Earth in the EDL phase. In the EDL phase, the vehicle must slow 
from its orbital velocity to its landing velocity at the end of the entry trajectory. Atmospheric drag is 
used to slow the vehicle down during the entry trajectory. However, friction between the vehicle and 
the atmosphere creates high aerothermodynamic heating that the can destroy the vehicle if not for its 
thermal protection system (TPS). The TPS of the vehicle is typically composed of a stack-up of 
materials that can withstand the expected high heating rates and temperatures during the entry. At the 
end of the entry trajectory, the vehicle can deploy parachutes or use retro-rockets to further reduce its 
velocity. Landings can occur in water or on land. 


On-orb rt 



Figure 1. Schematic of manned space mission analyzed by HFMR model. 
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In each phase there are failure scenarios that can lead to a loss of mission and possibly a loss of crew. 
Failure scenarios in each phase may include loss of control of the launch vehicle or catastrophic 
failures of the engines during ascent, damage due to micrometeoroid/orbital debris impacts while in 
orbit and TPS failures in the EDL phase. One possible failure of the TPS occurs when the temperature 
at some point in the system exceeds a given limit. For example, if the maximum allowable 
temperature of the adhesive used to bond the TPS material to the underlying structure is exceeded, the 
TPS material may separate, exposing the structure to the aerothermodynamic heating environment. 
This can lead to structural failure and a loss of crew. TPS failures can also result from the damage 
caused by MMOD impacts while on-orbit, higher-than-expected heating due to trajectory and/or 
atmospheric uncertainties, or larger-than-expected variations in the material properties of the TPS 
itself. 

Physics-based models are used to evaluate the crew risks associated with failure scenarios and the 
resulting failure environments. To date, models have been developed to assess the risk of blast 
overpressure [2,3] and debris strike [4,5] on the crew module resulting from a catastrophic failure of 
the launch vehicle. The failure scenarios are modeled using a level of fidelity necessary to resolve the 
physics involved. For example, the debris strike model defined the debris field in terms of the number 
of pieces and the mass, reference area, drag coefficient and imparted velocity of each piece. The 
model then computed the trajectory of each debris piece using a three degree-of-freedom trajectory 
tool. The probability of at least one piece of debris striking the crew vehicle was computed by 
comparing the relative position of the debris field and crew vehicle during an ascent abort. The 
conservative approach assumed that any debris strike resulted in a loss of crew. A vulnerability 
criterion was developed that related the penetration velocity as a function of the debris mass. 
Applying the criterion, only debris pieces that had a relative velocity greater than the penetration 
velocity were counted in the strike probability. The probability of loss-of-crew due to these failure 
scenarios are computed using the physics-based models in a Monte Carlo simulation. The Monte 
Carlo approach has been used to analyze the effect of dispersions or uncertainties on the entry 
trajectories for Apollo [5] through to Stardust [6]. Monte Carlo methods have been used to determine 
the effect of TPS material property uncertainties on the thermal response [7]. 

A physics-based model has been developed to assess some of the risks associated with the EDL phase. 
The model included modules to compute the entry trajectory, the aerothermodynamic environment 
during entry and the thermal response of the TPS to the heating environment. The model also 
included the capability to model the effects of MMOD damage on the TPS response. The Monte 
Carlo approach was used to account for dispersions and uncertainties in the vehicle state at the start of 
the entry phase, the aerothermodynamic environment and the TPS material properties. Failure criteria 
based on bondline temperature were used to determine the success or failure of each Monte Carlo 
sample. The following sections describe the EDL risk model in more detail and an application of the 
model to assess the EDL risks for a generic capsule-based manned vehicle design. 

The purpose of the TPS was to protect the underlying structure and crew from the heating 
environments encountered during the reentry. Without the TPS in place, the heating environment 
would cause structural failure and loss of crew. Potential failure scenarios for the TPS include 
manufacturing defects resulting in materials that did not have the expected thermal properties, entry 
trajectories resulting in heating environments more severe than expected and damage to the TPS from 
mishandling or MMOD impacts. The risk model was developed to assess the effects of the 
dispersions in material properties and vehicle state and the damage due to MMOD impacts on the 
ability of the TPS to protect the crew. The probability of failure is dependent upon the criteria used to 
measure success or failure of the system. 

2. EDL RISK MODEL 

The physics-based portions of the EDL risk model computed the aerodynamic and aerothermodynamic 
database for a given vehicle design, the entry trajectories and the TPS thermal response to the heating 
environments. The physics-based tools are integrated with an algorithm to perform the Monte Carlo 
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analysis and manage the resulting data sets. The analysis data flow of the physics-based portion of the 
model is shown in Figure 2. 



Figure 2. Flowchart of EDL risk model. 

CBAERO [8], an engineering level aerothermodynamics tool, was used to predict the aerodynamic 
and aerothermodynamic environment about the spacecraft during entry. Input data include a surface 
grid of the vehicle being analyzed and a range of values for Mach number, dynamic pressure and angle 
of attack to define the parameter space encompassing the entry trajectories. A component of 
CBAERO called CBTPS was used to determine the aerothermodynamic heating time history at 
specific points on the vehicle, given a particular trajectory. 

The trajectories were computed using OTIS, a three-degree-of-freedom trajectory optimization tool 
[9,10], starting from entry interface (El) and ending at the designated landing site. Lift and drag data 
for the vehicle were obtained from the CBAERO database. Optimized solutions were obtained using 
distance to a specified landing site as the objective function. Constraints were used to ensure that 
dynamic pressure, heat flux and total acceleration were within design limits. The optimization 
procedure may at times fail to find an optimized or feasible solution given the initial vehicle state and 
constraints. Currently, only successfully optimized trajectories are used in the risk analysis. 

The heating time history computed from the trajectory and aerothermodynamic database was used as 
input to compute the thermal response of the TPS stack-up. The thermal response of the TPS material 
stack-up was computed using FIAT, a one-dimensional transient analysis tool [11]. FIAT also 
required definitions of the TPS stack-ups and a database file containing the TPS material properties. 
FIAT computed the thermal response of the stack-up to the heating environment, generating output in 
the form of time histories of temperature and heat flux at specified locations in the stack-up. 

The risk of failure of the TPS was computed by comparing the data obtained from the FIAT analysis 
against a set of failure criteria, such as temperature limits at a specific depths or layers. Probabilities 
were computed using a Monte Carlo simulation. Dispersions in the vehicle state at the start of the 
entry trajectory, material properties of the TPS, the heating environment and TPS stack-up thickness 
were used to define the parameter space of the Monte Carlo simulation. 

A representation of a TPS stack-up is shown in Figure 3. The stack-up can be composed of multiple 
layers of materials, such as high-emissivity coatings, toughened materials to withstand impact damage, 
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substrate layers and adhesive layers that attached the TPS stack-up to the underlying structure. The 
stack-up was defined within a FIAT input file and included the thickness of each material layer. 


TPS 
stack- up 

Structure _ 



bondline 


Figure 3. Schematic of TPS stack-up in heat shield. 

The damage due to an MMOD strike was modeled by modifying the TPS stack-up to reflect the loss of 
material, as shown schematically in Figure 4. The damage was modeled as an hemisphere with radius 
equal to the cavity depth. To model the effect of damage on the bondline temperature using FIAT, an 
area-weighted average of the conduction heat flux, accounting for the regions of undamaged and 
damaged tile, was used. Failure risk was computed for two impact scenarios. The conservative 
approach assumed that all MMOD strikes occurred at the point of maximum heating. A more realistic 
approach randomly selected the point of impact in each Monte Carlo sample. 


Ca vity de pth 
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Figure 4. Schematic of TPS stack-up damage due to MMOD strike. 



Heat shield 


Figure 5. Side view of generic manned capsule. 
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3. EXAMPLE APPLICATION OF THE RISK MODEL 


The EDL risk model was applied to the analysis of a manned capsule designed for missions to low 
Earth orbit (LEO). The generic capsule design, shown in Figure 5, utilized a heat shield consisting of 
a reusable TPS material similar to that used on the Space Shuttle [12]. The TPS stack-up consisted of 
a high-emissivity coating, a toughened material layer, a substrate layer and an adhesive layer to attach 
the TPS stack-up to the structure. In this example, the failure criterion was set as the maximum 
temperature that the adhesive used to attach the TPS material to the structure could withstand before 
debonding occurred. If this temperature was exceeded, it was assumed that the TPS debonded from 
the structure, causing failure of the TPS. A conservative assumption was made that any failure of the 
TPS would lead to a loss of crew, either through subsequent failure of the vehicle structure due to the 
direct exposure to the heating environment or through loss of aerodynamic control due to changes in 
the outer mold line of the vehicle. 



a) Position track of nominal entry trajectory 



time (sec) 


b) altitude time history 



time (sec) 

c) Heat flux time history 



time (sec) 

d) Total heatload time history 


Figure 6. Nominal entry trajectory of generic capsule returning from LEO. 


CBAERO was used to compute lift and drag coefficients of the capsule assuming a center of gravity 
offset from the centerline of the vehicle. A nominal entry trajectory was computed using OTIS 
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assuming a return from the low Earth orbit (LEO) and a landing in the San Clemente Water Landing 
Area off the coast of California [13], as shown in Figure 6a. The nominal altitude, heat flux and total 
heat load time histories are plotted in Figure 6b through 6d, respectively. Typical of this type of entry, 
peak heating occurred early in the trajectory and decreased to near zero at the end of the trajectory as 
the vehicle velocity decreased. Since heat load was the time integral of the heat flux, the maximum 
occurred at the end of the trajectory. 

Monte Carlo simulations were computed using the uncertainty bounds for the vehicle state at entry 
interface listed in Table 1 and the TPS material properties listed in Table 2. Uniform distributions 
were assumed for all parameters. The risk model was used to assess the failure probability as a 
function of the design thickness of the heatshield. Given a nominal heatshield design, the risk model 
was used to assess the failure probability due to MMOD impact damage. In addition, the feasibility of 
using a response surface approach to reduce the computational expense of the Monte Carlo 
simulations was assessed. 


Table 1. Uncertainty bounds in vehicle state at entry interface. 


Parameter 

Range 

velocity 

±0.1% 

azimuth 

±0.05 deg 

FPA 

±0.25 deg 

longitude 

±0.2 deg 

latitude 

±0.2 deg 

mass 

±3% 


Table 2. Uncertainty bounds in TPS material properties. 


Parameter 

Range 

Heating augmentation factor 

1.0-1.25 

Density 

±4% 

Specific heat 

±5% 

Thermal conductivity 

±5% 

Cavity depth 

0-1.5 in 


3.1. Risk Assessment of the Heatshield Design Thickness 

The need to account for uncertainty and dispersions in the design can be illustrated in the following 
example. Using the nominal entry trajectory and nominal material property values, a minimum 
thickness for the heatshield, for which the temperature at the bondline no longer violated the 
maximum allowable value, can be obtained, as shown in Figure 7. Applying the risk model to include 
the effects of entry state and material property uncertainties on the bondline temperature indicated that 
additional thickness was required to reduce the failure probability to acceptable levels, as shown in 
Figure 8. 

The failure probabilities in Figure 8 were obtained using Monte Carlo simulations consisting of 2000 
samples. As the failure probability decreased to zero, additional samples were required to fully 
resolve the probability of failure. Results from Monte Carlo simulations consisting of 10000 samples 
are listed in Table 3 and indicate that a thickness of 2.6 in. was required to reduce the bondline 
temperature failure probability to a 1 in 10000 level. 
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Figure 7. Bondline temperature as function of heatshield thickness for nominal conditions. 



heatshield thickness (in) 

Figure 8. Bondline temperature failure probability as a function of heatshield thickness 


Table 3. Bondline temperature failure probabilities as function of heatshield thickness and 

number of MC simulation samples 


Thickness (in) 

Failure probability using 
2000 samples 

failure probability using 
10000 samples 

2.5 

0.001 

0.0044 

2.6 

0 

0.0001 

2.7 

0 

0 


3.2. Risk Assessment of MMOD Impact Damage 

Assuming that a failure probability on the order of le-4 was an acceptable risk, the nominal heatshield 
design was set to a thickness of 2.6 in. The risk model was then used to assess the failure probability 
of the heatshield design due to MMOD impact damage. The model assumed that an MMOD impact 
caused a hemispherical divot in the TPS stack-up with the penetration depth equal to the radius of the 
divot, as shown in Figure 4. For each Monte Carlo sample, the vehicle state at entry interface and the 
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TPS material properties were randomly generated based on the bounds listed in Tables 1 and 2. 
Bondline temperatures were computed using this set of values for penetration depths ranging from 0.1 
to 1.5 in. for the two impact scenarios discussed in Section 2. There were 10000 samples in each 
Monte Carlo simulation. Failure probabilities for MMOD impacts that always occurred at the point of 
highest heating are listed in Table 4. Failure probabilities for MMOD impacts at randomly selected 
points on the heatshield are listed in Table 5. Assuming that all MMOD impacts occurred at the point 
of maximum heating yielded higher failure probabilities, confirming the conservatism of this 
assumption. In this example, the additional local heating in the damage cavity and the growth of the 
cavity during reentry were not modeled. 


Table 4. Probability of exceeding bondline temperature limit for MMOD impacts at point of 

maximum heating. 


cavity depth (in) 

0 

0.1 

0.2 

0.3 

0.4 

0.5 

0.75 

1.0 

1.25 

1.5 

failure probability 

0.0001 

0.0001 

0.0001 

0.0002 

0.0004 

0.0005 

0.0094 

0.2421 

0.9338 

1.0000 


Table 5. Probability of exceeding bondline temperature limit for MMOD impacts at randomly 

selected points on heatshield. 


cavity depth (in) 

0 

0.1 

0.2 

0.3 

0.4 

0.5 

0.75 

1.0 

1.25 

1.5 

failure probability 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0001 

0.0057 

0.4929 


The choice of a bondline temperature limit as the failure criterion was appropriate for assessing the 
reliability of the system. A reusable TPS system would need to retain its integrity over a number of 
missions. This would not be possible if the TPS material did not remain attached to the vehicle. 
However, using the bondline temperature limit to assess the probability of TPS failures leading to a 
loss of crew may be too conservative. Typically, the maximum bondline temperature for each sample 
was reached at or near the end of the trajectory, mirroring the heatload time history shown in Figure 
6c.. Even if the adhesive were to fail, causing the TPS material to debond and exposing the structure 
to the environment, the heat flux near the end of the trajectory, as shown in Figure 6b, was low enough 
that structural failure due to heating would be a remote possibility. Loss of aerodynamic control due 
to changes to the outer mold line may not be an issue, either, especially if the capsule was under 
parachutes when the bondline temperature limit was reached. The development of appropriate failure 
criteria for loss of crew assessments is an area of active research. 


3.3. Response Surface Approach 

Each of the Monte Carlo simulations discussed in the previous section used the direct computation 
approach and required about 1800 CPU hours to complete on the NASA Pleiades supercomputer [14] 
using its Ivy Bridge nodes. A less computationally intensive approach was to generate a response 
surface defining the relationship between the bondline temperature and the input parameters in the 
parameter space. Once defined, the response surface was used to generate the values for the Monte 
Carlo sampling. The parameter space was defined by the variables listed in Tables 1 and 2. Kriging 
[15] was selected as the multivariate interpolation scheme used to create the response surface. Kriging 
required a training data set to determine the interpolation coefficients used in the scheme. A Latin 
hypercube design was used to populate the parameter space with the training data points. A total of 
2000 data points were used in the training set, requiring about 300 CPU hours to compute. The 
response surface generated from the training data was used to predict the bondline temperature in 
Monte Carlo simulations consisting of 10000 samples. MATLAB was used to generate the response 
surface and perform the Monte Carlo simulation. This took about 10 minutes on a single CPU. Table 
6 lists the failure probabilities as a function of penetration depth predicted using the response surface 
and the direct computation approach for the nominal heatshield thickness, assuming all impacts were 
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at the point of maximum heating. For small penetration depths (< 0.5 in.), the response surface was 
not able to resolve the low failure probabilities. The response surface was better able to resolve the 
higher failure probabilities for the larger penetration depths. Since the response surface method was 
faster, used less computational resources and provided reasonable estimates of the failure probabilities, 
the method would be useful in quickly providing risk information about early vehicle designs. Once 
the design matured, the direct computation method would be used to generate more refined risk data. 

Table 6. Probability of bondline temperature failure due to MMOD strike damage predicted 

using response surface. 


Cavity depth (in) 

0 

0.1 

0.2 

0.3 

0.4 

0.5 

0.75 

1 

1.25 

1.5 

Response surface 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0082 

0.4232 

0.9613 

0.9987 

Direct computation 

0.0001 

0.0001 

0.0001 

0.0002 

0.0004 

0.0005 

0.0094 

0.2421 

0.9338 

1.0000 


4. CONCLUSION 

A physics-based model was developed to predict the probability of a loss of crew due to failure 
scenarios that can occur during the entry, descent and landing phase of a manned space mission. The 
model integrated an engineering-level aerothermodynamics tool to compute the lift, drag and heating 
coefficients for a given vehicle, a three-degree-of-freedom trajectory tool to compute the entry 
trajectory and a one-dimensional transient response code to predict the thermal response of the vehicle 
thermal protection system. The model accounted for damage to the TPS due to MMOD impacts. 
Monte Carlo simulations were used to predict the effects of dispersions and uncertainties in the vehicle 
state at the start of the entry trajectory, the heating environment during the trajectory and the material 
properties of the TPS on the ability of the vehicle to operate within its design limits. Both direct 
computation and response surface methods were used in the Monte Carlo simulations. 

The model was used to analyze a generic manned capsule designed for missions to low Earth orbit. A 
temperature limit at the bondline between the TPS and the underlying structure was used as the failure 
criterion. Exceeding the temperature limit would cause the TPS material to debond from the structure. 
The model was used to determine the nominal heatshield thickness based on the failure probabilities 
due to the dispersions in trajectory, aerothermodynamic heating and material properties. For the 
nominal heatshield design, the model was used to predict the failure probabilities due to MMOD 
damage. Conservative values were obtained by assuming the MMOD impact always occurred at the 
point of maximum heating. More realistic values were obtained by assuming the impacts occurred at 
random locations on the heatshield. 

A response surface approach was also developed to predict the failure probabilities in a less 
computationally intensive manner. The response surface was built using Kriging as the interpolation 
scheme and a Latin hypercube design to populate the parameter space. The response surface provided 
results that compared well with the data obtained using the direct computation method and certainly 
can be used in the preliminary design phase to quickly provide risk information. 

The selection of a bondline temperature limit was appropriate for assessing the reliability of the TPS 
design. Using the criterion to predict the probability of loss of crew due to TPS failures may be too 
conservative for the sample problem, since bondline temperature failures typically occurred late in the 
trajectories, when heating may not be significant enough to cause structural damage. The 
development of appropriate failure criteria for the assessment of loss of crew probabilities during the 
EDL phase is an ongoing research topic. 
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